"According to the views of the data protection authority," reads a news release from the Hamburg Commissioner of Data Protection and Freedom of Information, "the ongoing practice of user profiling affects the privacy of Google users far beyond the admissible degree."
At particular issue is how Google blends a user's data collected across its various services into one unifying profile. "In short, we'll treat you as a single user across all our products," the company said in announcing the controversial opt-out policy in 2012. Google argues that the way data slips between its products leads to more useful tools, making it "easy for you to read a memo from Google Docs right in your Gmail, or add someone from your Gmail contacts to a meeting in Google Calendar."
Critics say Google's driving interest is in using that data to sell targeted advertising.
The danger, says Johannes Caspar, the Hamburg data commissioner, is something sometimes called "the mosaic effect" — the fact that data in combination can reveal more than standalone nuggets of information. Caspar warned that everything from local data to search engine requests can be used to determine a user's travels, interests, financial standing, social status and sexual orientation.
Caspar, the Hamburg data commissioner, has been a particular foe of Google's. He has gone after the company for grabbing private information off of unsecured wireless networks. And Germany is a challenging place for Google to operate, as the country values privacy so much that each of the country's sixteen federal states has a data protection commissioner.*
But the complaints against Google there are part of a larger pattern in Europe. Last week, data regulators there sent the company a detailed list of possible measures it should take to comply with data directives, from building country-specific privacy options into its Google Analytics service to changing the language on its data practices from "we can" or "we may" to "if you use services A and B, we will ... "
In the United States, there has been some push-back against ad-driven, data-hungry services, but to little practical effect. Witness the considerable attention being paid to the advertising-free Ello social network that nonetheless doesn't seem to be generating meaningful user traction.
It is up to Google now, said Caspar, to figure out how to engineer its products in ways that comply with the order's expectation of siloed data. "The company," the data commissioner said, "must treat the data of its millions of users in a way that respects their privacy adequately while they use the various services of the company."
*Update: This paragraph has been updated to better reflect the nature of Germany's federal data protection authority system.